Re: Security

["Frank Ellermann" <nobody@xxxxxxxxxxxxxxxxx>]

Sam Hartman wrote:

> we should not recommend it.

The draft is very clear about that, maybe even on the
wrong side of the border to exaggeration.

To take another example, just because RFC 862 is also
known as STD 20 doesn't mean that starting echo servers
is "recommended".  

It means "IFF you do that here is how this works since
25 years":  mature + interoperable != recommended.

Similar, the POP3 standard (STD 53) doesn't imply that
folks better stay away from IMAP (not a STD).  Quite
the contrary it is a point of POP3 that there will be
no additional (= unnecessary) features.

Ditto RFC 3986 (URIs, STD 66) vs. 3987 (IRIs, not yet
as mature as URIs).

> If people want to update digest-md5 on the standards
> track, I will not stand in their way.  I personally
> don't think it worth doing.

<shrug />  Alexey's drafts were near to ready from my
POV, but "squeeze more features into a SASL mechanism
already suffering badly from far too many features" was
no good idea.  

Splitting it into a "+" version with a new name was an
idea.  The current standardization situation is again
strange:  RFC 2617 and 2831 are almost identical, 2831
is slightly better (wrt i18n), the better version will
be deprecated, keeping a less capable RFC 2617 (or its
successor).  

But I'm not going to appeal the DIGEST-MD5 decision,
actually its featurism and implementation difficulties
are the reason why I defend the far simpler CRAM-MD5.

 Frank